System and method for data loss prevention in a virtualized environment

ABSTRACT

A data loss prevention (DLP) manager running on a security virtual machine manages DLP policies for a plurality of guest virtual machines. The DLP manager identifies a startup event of a guest virtual machine, and installs a DLP component in the guest virtual machine. The DLP component communicates with the DLP manager operating within the security virtual machine. The DLP manager also receives file system events from the DLP component, and enforces a response rule associated with the guest virtual machine if the file system event violates a DLP policy.

TECHNICAL FIELD

The embodiments of the disclosure relate generally to virtual machinesystems and, more specifically, relate to data loss prevention in avirtualized environment.

BACKGROUND

In computer science, a virtual machine (VM) is a portion of softwarethat, when executed on appropriate hardware, creates an environmentallowing the virtualization of an actual physical computer system. EachVM may function as a self-contained platform, running its own operatingsystem (OS) and software applications (processes). Typically, a virtualmachine monitor (VMM) manages allocation and virtualization of computerresources and performs context switching, as may be necessary, to cyclebetween various VMs.

A host machine (e.g., computer or server) is typically enabled tosimultaneously run multiple VMs, where each VM may be used by a remoteclient. The host machine allocates a certain amount of the host'sresources to each of the VMs. Each VM is then able to use the allocatedresources to execute applications, including operating systems known asguest operating systems. The VMM virtualizes the underlying hardware ofthe host machine or emulates hardware devices, making the use of the VMtransparent to the guest operating system or the remote client that usesthe VM.

Data Loss Prevention (DLP) in a virtual machine environment requires anagent to be installed on each virtual machine to prevent loss ofsensitive data through removable devices (i.e., USB drives, CD/DVD), andnetwork shares. However, ensuring that every VM that gets created has anup-to-date DLP agent is a challenge and an inefficient use of systemresources.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the present disclosure are illustrated by way of example,and not by way of limitation, and can be more fully understood withreference to the following detailed description when considered inconnection with the figures in which:

FIG. 1 illustrates one embodiment of a virtual machine (VM) host serverdevice, which employs a dedicated security virtual machine and a DataLoss Protection (DLP) manager to perform data loss protection;

FIG. 2 illustrates one embodiment of a DLP manager and a DLP componentoperating in a virtual machine environment;

FIG. 3 illustrates one embodiment of the DLP manager and DLP component;

FIG. 4 illustrates a flow diagram of one embodiment of a method forimplementing a DLP manager;

FIG. 5 illustrates a flowchart diagram of a method for monitoring filesystem events according to one embodiment;

FIG. 6 illustrates a flowchart diagram of a method for anotherembodiment of monitoring a file system event; and

FIG. 7 is a diagram of one embodiment of a computer system forfacilitating the execution of the DLP manager.

DETAILED DESCRIPTION

Described herein are methods and systems for data loss prevention (DLP)in virtual machines. Embodiments of the present disclosure provide a DLPmanager running on a security virtual machine that manages DLP policiesfor a plurality of guest virtual machines. The DLP manager identifies astartup event of a guest virtual machine, and installs a DLP componentin the guest virtual machine. In one embodiment, the DLP managerinstalls a DLP component in the guest virtual machine before any otherapplications are launched on the guest virtual machine. The DLPcomponent communicates with the DLP manager operating within thesecurity virtual machine. The DLP manager also receives file systemevents from the DLP component, and enforces one or more response rulesassociated with the guest virtual machine if the file system eventviolates a DLP policy.

In the following description, numerous details are set forth. It will beapparent, however, to one skilled in the art, that the present inventionmay be practiced without these specific details. In some instances,well-known structures and devices are shown in block diagram form,rather than in detail, in order to avoid obscuring the presentinvention.

Some portions of the detailed descriptions, which follow, are presentedin terms of algorithms and symbolic representations of operations ondata bits within a computer memory. These algorithmic descriptions andrepresentations are the means used by those skilled in the dataprocessing arts to most effectively convey the substance of their workto others skilled in the art. An algorithm is here, and generally,conceived to be a self-consistent sequence of steps leading to a desiredresult. The steps are those requiring physical manipulations of physicalquantities. Usually, though not necessarily, these quantities take theform of electrical or magnetic signals capable of being stored,transferred, combined, compared, and otherwise manipulated. It hasproven convenient at times, principally for reasons of common usage, torefer to these signals as bits, values, elements, symbols, characters,terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise, as apparent from the followingdiscussion, it is appreciated that throughout the description,discussions utilizing terms such as “providing,” “generating,”“installing,” “monitoring,” “enforcing,” “receiving,” “logging,”“intercepting”, or the like, refer to the action and processes of acomputer system, or similar electronic computing device, thatmanipulates and transforms data represented as physical (electronic)quantities within the computer system's registers and memories intoother data similarly represented as physical quantities within thecomputer system memories or registers or other such information storage,transmission or display devices.

The present invention also relates to an apparatus for performing theoperations herein. This apparatus may be specially constructed for therequired purposes, or it may comprise a general-purpose computerselectively activated or reconfigured by a computer program stored inthe computer. Such a computer program may be stored in a computerreadable storage medium, such as, but not limited to, any type of diskincluding floppy disks, optical disks, CD-ROMs, and magnetic-opticaldisks, read-only memories (ROMs), random access memories (RAMs), EPROMs,EEPROMs, magnetic or optical cards, or any type of media suitable forstoring electronic instructions, each coupled to a computer system bus.

The present invention may be provided as a computer program product, orsoftware, that may include a machine-readable medium having storedthereon instructions, which may be used to program a computer system (orother electronic devices) to perform a process according to the presentinvention. A machine-readable medium includes any mechanism for storingor transmitting information in a form readable by a machine (e.g., acomputer). For example, a machine-readable (e.g., computer-readable)medium includes a machine (e.g., a computer) readable storage mediumsuch as a read only memory (“ROM”), random access memory (“RAM”),magnetic disk storage media, optical storage media, flash memorydevices, etc.

Reference in the description to “one embodiment” or “an embodiment”means that a particular feature, structure, or characteristic describedin connection with the embodiment is included in at least one embodimentof the invention. The phrase “in one embodiment” located in variousplaces in this description does not necessarily refer to the sameembodiment. Like reference numbers signify like elements throughout thedescription of the figures.

FIG. 1 illustrates one embodiment of a virtual machine (VM) host serverdevice 100, which employs a dedicated security virtual machine 101 and aData Loss Protection (DLP) manager 104 to perform data loss protection.As illustrated, base platform hardware 116 comprises a computingplatform, which may be capable, for example, of executing an operatingsystem (OS) or a virtual-machine monitor (VMM), such as VMM 112. In someembodiments, base hardware platform 116 may include a processor 118,memory devices 120, network devices, drivers, and so on. The VMM 112virtualizes the physical resources of the base hardware platform 116 forone or more guest VMs 102 that are hosted by the server device 100having the base hardware platform 116. In some embodiments, the VMM 112may also be referred to as a hypervisor, a kernel-based hypervisor(e.g., Kernel-based VM (KVM)), or a host OS. In one embodiment, each VM102 includes a guest operating system (OS), such as guest OS 106 andvarious guest software applications 110.

The DLP manager 104 identifies, monitors, and protects data in use(e.g., endpoint actions), data in motion (e.g., network actions), anddata at rest (e.g., data storage). Such data may be in the form offiles, messages, web requests or the like. Typically, a DLP systemmonitors various files, messages, etc. to determine whether theyconstitute use-restricted documents or objects. A use-restricteddocument represents a document that cannot be freely distributed ormanipulated due to its sensitive nature. Use-restricted documents may bemarked with such words as “confidential,” “sensitive,” “stock,” etc. toindicate their sensitive nature. In addition, use-restricted documentsmay include confidential information such as customer, employee, orpatient personal information, pricing data, design plans, source code,CAD drawings, financial reports, etc.

The DLP manager 104 may determine whether a file or a message is ause-restricted document by applying a DLP policy. A DLP policy mayspecify what data should be present in a file or message to beclassified as a use-restricted document. For example, a DLP policy mayspecify one or more keywords (e.g., “confidential,” “sensitive,”“stock,” names of specific diseases (e.g., “cancer,” “HIV,” etc.), etc.)for searching various files, messages and the like. Additionally, theDLP Policy may specify other methods for identifying policy violationsincluding, but not limited to, exact data matching (EDM), indexeddocument matching (IDM), and vector machine learning (VML). DLP policieswill be discussed in greater detail below with reference to FIG. 3.

Instead of a typical DLP system, where each virtual machine wouldinclude a DLP agent, FIG. 1 illustrates that the DLP manager 104operates within a dedicated security VM (SVM) 101 and communicates withDLP components 108 operating on the guest VMs 102. In anotherembodiment, the DLP manager 104 may operate within the VMM 112 or otherhypervisor process. The DLP manager 104 communicates across a virtualcommunication channel with a DLP component 108 operating within each ofthe guest VMs 102. The virtual communication channel, in one embodiment,is a virtual network where each VM 101, 102 may communicate usingstandard networking protocols, or proprietary networking protocols overan isolated virtual network dedicated to security functions. In anotherembodiment, the virtual communication channel is a virtualizedcommunication bus coupling each of the VMs 101, 102 with the VMM 112.The DLP component 108 may be configured as part of the operating system106, or alternatively, an embedded process of the virtualized hardwareof the guest virtual machine 102. The DLP manager 104 and DLP component108 will be discussed below in greater detail with reference to FIGS. 2and 3.

FIG. 2 illustrates one embodiment of a DLP manager 104 and a DLPcomponent 108 operating in a virtual machine environment underembodiments of the present invention. In the depicted embodiment, theDLP manager 104 and the DLP component 108 are configured to operate inconcert with a DLP system 201 that includes a hypervisor security driver202 and VM security drivers 204. One example of a virtual machine DLPsystem suitable for use with the present disclosure is the VMwarevShield™ framework developed by VMware® of Palo Alto, Calif.Alternatively, and as described above, the DLP manager 104 and the DLPcomponent 108 may be configured to operate independently of a virtualmachine DLP system 201.

The hypervisor security driver 202 may be implemented as a processoperating on the VMM 112 and may be configured to communicating with aplurality of guest virtual machines 102, although only one is depictedhere in FIG. 2 for clarity. The DLP manager 104, in one embodiment,communicates with each guest DLP component 108 via the DLP system 201.The DLP manager 104 is configured to receive notifications from the DLPcomponent 108 that are indicative of virtual machine and file systemactivity events. Examples of virtual machine events include, but are notlimited to, VM power on events, shutdown events, migration andreconfiguration events. Examples of file system events include, but arenot limited to, file open events, file close (e.g., save) events, fileread/write, copy/paste events, move file events, and file deletionevents.

When the guest VM 102 is powered on, the DLP manager 104 is configuredto intercept the power on event of the VM 102, identify the VM 102, andmaintain identity information of the VM 102, as will be described ingreater detail below with reference to FIG. 3. In one embodiment, theDLP manager 104 identifies the VM 102 by identifying the operatingsystem and/or roles (e.g., file server, email server, desktop, etc.) ofthe VM 102. In a further embodiment, the DLP manager 104 identifies ahash value of a kernel of the operating system, for example. In anotherexample, the DLP manager 104 identifies the VM 102 by name specified inthe VMM 112. One of skill in the art will recognize that there are manydifferent methods for uniquely identifying a VM 102 that may be used inaccordance with embodiments of the present disclosure.

The DLP component 108 is configured to communicate with the DLP manager104 file system events. For example, when a user initiates a file systemevent within the guest VM 102, the DLP component 108 intercepts the filesystem event and analyzes the event to determine the type of file systemevent (e.g., open, close, move, copy, read, write, delete, etc.) andtransmits this information to the DLP manager 104. The informationcollected by the DLP component 108 and communicated with the DLP manager104 may also comprise file or object information including, but notlimited to, source, destination, file type (e.g., document, spreadsheet,media object, etc.), and file classification (e.g., personal, corporate,confidential, etc.). In some embodiments the information collected bythe DLP component 108 and communicated with the DLP Manager 104 mayinclude the application and the user initiating the file system event.The DLP component 108 is also configured, in one embodiment, with a DLPuser interface for receiving from a user a justification for in theevent where the DLP manager 104 identifies the user has violated a DLPpolicy.

FIG. 3 illustrates one embodiment of the DLP manager 104 and DLPcomponent 108 under embodiments of the present invention. In oneembodiment, the DLP manager 104 includes a VM identifier 302 and a VMidentity repository 304. The VM identifier 302 uniquely identifies guestvirtual machines as described above with reference to FIG. 2. The DLPmanager 104 is configured to determine if an identified guest virtualmachine has a DLP security profile 306 associated with the guest virtualmachine stored in the repository 304. The repository 304 maintains aplurality of profiles 306, one profile 306 for each virtual machine, or,one profile 306 for multiple virtual machines. Each of the profiles 306may include a data policy 308 and a response rule 310 for when the datapolicy 308 is violated.

The DLP policies 308 specify rules for monitoring content to detectpresence of confidential information. For example, a DLP policy 308 rulemay specify one or more keywords (e.g., “confidential,” “sensitive,”“stock,” names of specific diseases (e.g., “cancer,” “HIV,” etc.), etc.)for searching various files, messages and the like. In addition tokeywords, a DLP policy 308 may include other rules for detectingpresence of confidential data in information content being monitored.For example, in a financial organization, a DLP policy 308 may specifythat if a message contains the word “confidential,” further search ofthe message should be performed to determine whether the messageincludes customer data (e.g., a social security number, first name, lastname, etc.) or other sensitive information (e.g., financial reports,source code, etc.). The response rule 310 specifies what actions shouldbe taken when a policy violation is detected. For example, a responserule 310 may require that a message containing confidential data beblocked, re-routed, reported, quarantined, encrypted, etc.

In one embodiment, the DLP policy 308 includes rules for exact datamatching (EDM) and/or a indexed document matching (IDM). Exact datamatching (EDM) may be used for protecting data that is typically instructured formats, such as database records. Indexed document matching(IDM) may be used to protect unstructured data, such as Microsoft® Wordor PowerPoint® documents, or CAD drawings. For both EDM and IDM,sensitive data is first identified. The DLP manager 104 thenfingerprints the sensitive data for precise, ongoing detection. In oneembodiment, the fingerprinting process includes accessing and extractingtext and data, normalizing it, and securing it using a nonreversiblehash. When a file or other data is to be scanned, a fingerprint (e.g.,hash) is generated of that file or contents of that file and compared tostored fingerprints. If a match is found, then the scanned file isidentified as containing sensitive data.

In one embodiment, the DLP policy 3038 includes a vector machinelearning (VML) profile. Vector machine learning may be used to protectsensitive unstructured data. For VML, a training data set including aset of sensitive data and a set of non-sensitive data is provided to theDLP Manager 104. The DLP manager 104 analyzes the training data setusing vector machine learning to generate a classification model and afeature set, which are added to the VM security profile 306 along withthe training data set. The classification model is a statistical modelfor data classification that includes a map of support vectors thatrepresent boundary features. The feature set is a data structure such asa list or table that includes multiple features (e.g., words) extractedfrom the training data set. The DLP manager 104 is configured to processthe profile 306 and input unclassified data to classify the data assensitive or non-sensitive (or to classify the data as personal data orcorporate data).

The DLP manager 104 may create a default policy for every VM detected,or may customize a VM profile 306 depending upon the role of the virtualmachine. Additionally, the DLP manager 104 is configured to receivecustomized VM profiles 306 for various users who log onto the VM, otherDLP managers 104, or hypervisor security devices.

DLP policies 308 are provided to the DLP manager 104 that in turnperforms content monitoring to detect policy violations across the VMs102. In another embodiment, the DLP manager 104 is configured tocommunicate the VM profile 306 (e.g DLP configuration) that isassociated with a specific VM 102 and DLP component. The DLP component108 is configured to determine if the DLP policy requires monitoring ofthe source device which may include data in motion such as incoming andoutgoing messages or web requests transported using various protocols(e.g., simple mail transfer protocol (SMTP), hypertext transfer protocol(HTTP), file transfer protocol (FTP), AOL Instant Messaging (AIM), ICQ,single object access protocol (SOAP), SQLNet, transmission controlprotocol/Internet protocol (TCP/IP), user datagram protocol (UDP),Ethernet, 802.11, etc.). If the DLP component 108 identifies that thesource device requires monitoring, the DLP component 108 transmits anotification to the DLP manager 104. The DLP manager 104 may analyze thedata associated with the file and create a record identifying thecontent, the relevant DLP policy 308, and a user associated with theviolation, if the data violates policy 308. In addition, the DLP manager104 may be configured to remotely take other actions required by theresponse rules 310. In another embodiment, the DLP component 108 locallyperforms these actions required by the response rules 310.

The DLP component 108, in one embodiment, may also be configured toanalyze fingerprints of the source data instead of the actual sourcedata, to avoid exposing the confidential information and to facilitatemore efficient searching of the content. Fingerprints may include hashesof source data, encrypted source data, or any other signatures uniquelyidentifying the source data. The DLP component 108 may then report DLPpolicy violation(s) to the DLP manager 104, and/or may perform othernecessary actions (e.g., blocking or rerouting the relevant content).Alternatively, the DLP manager 104 may be configured to remotely performthe monitoring and analyzing of data.

FIGS. 4-6 are flowchart and/or block diagram illustrations of methods,systems, and computer program products according to an embodiment of thedisclosure. It will be understood that each block of the flowchartand/or block diagram illustrations, and combinations of blocks in theflowchart and/or block diagram illustrations, may be implemented byprocessing logic. The processing logic may comprise hardware (circuitry,dedicated logic, etc.), software (such as is run on a general-purposecomputer system or a dedicated machine), or a combination of both. Thesesoftware instructions, or other computer program instructions, may beprovided to a processor of a general purpose computer, special purposecomputer, or other programmable data processing apparatus to produce theprocessing logic, such that the instructions, which execute via theprocessor of a computer or other programmable data processing apparatus,implement the functions specified in the flowchart and/or block diagramblock or blocks.

FIG. 4 illustrates a flow diagram of one embodiment of a method 400 forimplementing a DLP manager 104 under embodiments of the presentinvention. The method starts and the processing logic, at block 402,detects a virtual machine startup event. In one embodiment, theprocessing logic is configured to capture a startup event by identifyinga virtual machine that has requested computing resources from ahypervisor. The processing logic then, at block 404, intercepts thestartup request and identifies, at block 406, the virtual machine. Theprocessing logic is configured to identify the virtual machine byanalyzing the characteristics of the virtual machine. Thesecharacteristics can include, but are not limited to, resources requestedby the virtual machine, the type of operating system of the virtualmachine, the operating role of the virtual machine (e.g., file server,email server, database server, etc.), and/or a fingerprint of theoperating system or kernel, or the name of the virtual machine asspecified in the VMM or name of the business unit to which the virtualmachine belongs.

At block 408, the processing logic saves the virtual machine informationto the repository 304. In one embodiment, the processing logicdetermines if the virtual machine information already exists as avirtual machine profile 306. If a virtual machine profile 306 does notexist for the identified virtual machine, the processing logic isconfigured to create a new virtual machine profile 306 with a defaultDLP policy 308 and response rule 310. In another embodiment, theprocessing logic retrieves a virtual machine profile 306 from, forexample, the hypervisor security driver 202 of FIG. 2.

At block 410, the processing logic remotely installs the DLP componentin the identified virtual machine. The processing logic is configured toinstall the DLP component by pushing and automatically installing theDLP component. At block 412, the processing logic optionally installs auser interface configured to notify a user of DLP policy violations. Inone embodiment, the user interface presents a visual or aural message tothe user. Alternatively, the user interface may transmit a message(e.g., email) to the user. The method 400 then ends.

FIG. 5 illustrates a flowchart diagram of a method 500 for monitoringfile system events under embodiments of the present invention. Themethod begins and processing logic, at block 502, detects a “file close”event in the guest virtual machine. In one embodiment, the processinglogic receives a notification from, for example, a DLP component 108 ofthe virtual machine 102 that indicates a user is closing a file. Theprocessing logic, at block 504, retrieves the VM identity profile 306from the repository 304 (see FIG. 3) that matches the VM that initiatedthe file close event.

At block 506, the processing logic identifies the storage targetassociated with the file close event. For example, the processing logicis configured to determine if the storage target device is a removabledevice, removable medium, network share, etc. If the DLP policy 308requires monitoring of the storage target device, the processing logic,at block 510, is configured to analyze the data the user is requestingto be stored on the target device. If the DLP policy 308 does notrequire monitoring of the storage target device, the processing logic,at block 512, allows the data transfer.

At block 514, the processing logic determines if the analyzed dataviolates the DLP policy 308. For example, the DLP policy 308 rule mayspecify one or more keywords (e.g., “confidential,” “sensitive,”“stock,” names of specific diseases (e.g., “cancer,” “HIV,” etc.), etc.)for searching various files, messages and the like. In addition tokeywords, the DLP policy 308 may include other rules for detectingpresence of confidential data in information content being monitored.For example, in a financial organization, a DLP policy 308 may specifythat if a message contains the word “confidential,” further search ofthe message should be performed to determine whether the messageincludes customer data (e.g., a social security number, first name, lastname, etc.) or other sensitive information (e.g., financial reports,source code, etc.). If the analyzed data does not violate the DLP policy308, the processing logic, at block 512, allows the data transfer.

If, however, the analyzed data does violate the DLP policy, theprocessing logic, at block 516, executes the response rule(s) 310associated with the DLP policy 308. For example, the response rule 310may require that a message containing confidential data be blocked,re-routed, reported, quarantined, encrypted, etc. The processing logic,at block 518, logs the policy violation and the actions taken inresponse to the policy violation. In a further embodiment, theprocessing logic instructs the DLP user interface to indicate to theuser that the user has violated a DLP policy. For example, the DLP userinterface may be configured to present a message on a screen to theuser, and/or transmit a message to the user via email. The method 500then ends.

FIG. 6 illustrates a flowchart diagram of a method 600 for anotherembodiment of monitoring a file system event under embodiments of thepresent invention. The method 600 starts and the processing logic, atblock 602, detects a file creation or file open event in a guest virtualmachine. The processing logic, in one embodiment, is configured toremotely monitor file system events in the virtual machine.Alternatively, the processing logic is configured to receivenotification from the DLP component 108.

At block 604, the processing logic retrieves the virtual machineidentity of the virtual machine associated with the file system event.The processing logic, as described above, is configured to uniquelyidentify the virtual machine by analyzing characteristics of the virtualmachine. The characteristics may include, but are not limited to, typeof operating system, types of virtual devices associated with thevirtual machine, and the role of the virtual machine. In a furtherembodiment, the processing logic identifies a fingerprint of theoperating system or kernel of the virtual machine. The processing logicis also configured to retrieve from the repository 304 a DLP profileassociated with the identified virtual machine.

At block 606, the processing logic identifies the source device of thefile system event. For example, the processing logic identifies if auser is attempting to open an existing file from the Internet, from anattached storage device, from a local storage drive, from a networkattached storage device, etc. The processing logic then, at block 608,determines if the DLP profile 308 requires monitoring of the identifiedsource device. If the DLP profile 308 does not require monitoring of thesource device, the processing logic, at block 610, allows the file to beopened

If, however, the DLP profile 308 requires monitoring of the sourcedevice, the processing logic makes a copy, at block 612, of the data inthe file to be opened. In one embodiment, the processing logic may makea copy of the data in a dedicated storage area of the security VM 101 ofFIG. 1. Alternatively, the processing logic may make a copy of the datain a dedicated storage area in the guest VM 102. The processing logic,at block 616, when receives a notification from the DLP component 108 ofthe virtual machine 102 that indicates a user is closing a file, itdetermines whether the modified file violates the DLP policy 308. Forexample, the processing logic is configured to analyze the content forwords and media objects (e.g., images, audio objects, and video objects)that violate the DLP policy. If the processing logic determines theanalyzed data does not violate the DLP policy 308, the processing logicallows the data transfer at block 610. If the analyzed data violate theDLP policy, the processing logic at block 618 executes the responserule(s) 310 associated with the DLP policy 308 and restores the copy ofthe file to its original location. The processing logic, at block 619,deletes the copy of the file and method 600 then ends.

FIG. 7 is a diagram of one embodiment of a computer system forfacilitating the execution of the DLP manager. Within the computersystem 700 is a set of instructions for causing the machine to performany one or more of the methodologies discussed herein. In alternativeembodiments, the machine may be connected (e.g., networked) to othermachines in a LAN, an intranet, an extranet, or the Internet. Themachine can be a host in a cloud, a cloud provider system, a cloudcontroller, or any other machine. The machine can operate in thecapacity of a server or a client machine in a client-server networkenvironment, or as a peer machine in a peer-to-peer (or distributed)network environment. The machine may be a personal computer (PC), atablet PC, a console device or set-top box (STB), a Personal DigitalAssistant (PDA), a cellular telephone, a web appliance, a server, anetwork router, switch or bridge, or any machine capable of executing aset of instructions (sequential or otherwise) that specify actions to betaken by that machine. Further, while only a single machine isillustrated, the term “machine” shall also be taken to include anycollection of machines (e.g., computers) that individually or jointlyexecute a set (or multiple sets) of instructions to perform any one ormore of the methodologies discussed herein.

The exemplary computer system 700 includes a processing device 702, amain memory 704 (e.g., read-only memory (ROM), flash memory, dynamicrandom access memory (DRAM) such as synchronous DRAM (SDRAM) or DRAM(RDRAM), etc.), a static memory 706 (e.g., flash memory, static randomaccess memory (SRAM), etc.), and a secondary memory 718 (e.g., a datastorage device in the form of a drive unit, which may include fixed orremovable computer-readable storage medium), which communicate with eachother via a bus 730.

Processing device 702 represents one or more general-purpose processingdevices such as a microprocessor, central processing unit, or the like.More particularly, the processing device 702 may be a complexinstruction set computing (CISC) microprocessor, reduced instruction setcomputing (RISC) microprocessor, very long instruction word (VLIW)microprocessor, processor implementing other instruction sets, orprocessors implementing a combination of instruction sets. Processingdevice 702 may also be one or more special-purpose processing devicessuch as an application specific integrated circuit (ASIC), a fieldprogrammable gate array (FPGA), a digital signal processor (DSP),network processor, or the like. Processing device 702 is configured toexecute the instructions 726 for performing the operations and stepsdiscussed herein.

The computer system 700 may further include a network interface device722. The computer system 700 also may include a video display unit 710(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT))connected to the computer system through a graphics port and graphicschipset, an alphanumeric input device 712 (e.g., a keyboard), a cursorcontrol device 714 (e.g., a mouse), and a signal generation device 720(e.g., a speaker).

The secondary memory 718 may include a machine-readable storage medium(or more specifically a computer-readable storage medium) 724 on whichis stored one or more sets of instructions 726 embodying any one or moreof the methodologies or functions described herein. In one embodiment,the instructions 726 include instructions for the DLP manager 104. Theinstructions 726 may also reside, completely or at least partially,within the main memory 704 and/or within the processing device 702during execution thereof by the computer system 700, the main memory 704and the processing device 702 also constituting machine-readable storagemedia.

The computer-readable storage medium 724 may also be used to store theinstructions 726 persistently. While the computer-readable storagemedium 724 is shown in an exemplary embodiment to be a single medium,the term “computer-readable storage medium” should be taken to include asingle medium or multiple media (e.g., a centralized or distributeddatabase, and/or associated caches and servers) that store the one ormore sets of instructions. The term “computer-readable storage medium”shall also be taken to include any medium that is capable of storing orencoding a set of instructions for execution by the machine and thatcause the machine to perform any one or more of the methodologies of thepresent invention. The term “computer-readable storage medium” shallaccordingly be taken to include, but not be limited to, solid-statememories, and optical and magnetic media.

The instructions 726, components and other features described herein canbe implemented as discrete hardware components or integrated in thefunctionality of hardware components such as ASICS, FPGAs, DSPs orsimilar devices. In addition, the instructions 726 can be implemented asfirmware or functional circuitry within hardware devices. Further, theinstructions 726 can be implemented in any combination hardware devicesand software components.

In the above description, numerous details are set forth. It will beapparent, however, to one skilled in the art, that the present inventionmay be practiced without these specific details. In some instances,well-known structures and devices are shown in block diagram form,rather than in detail, in order to avoid obscuring the presentinvention.

Some portions of the detailed description, which follows, are presentedin terms of algorithms and symbolic representations of operations ondata bits within a computer memory. These algorithmic descriptions andrepresentations are the means used by those skilled in the dataprocessing arts to most effectively convey the substance of their workto others skilled in the art. An algorithm is here, and generally,conceived to be a self-consistent sequence of steps leading to a result.The steps are those requiring physical manipulations of physicalquantities. Usually, though not necessarily, these quantities take theform of electrical or magnetic signals capable of being stored,transferred, combined, compared, and otherwise manipulated. It hasproven convenient at times, principally for reasons of common usage, torefer to these signals as bits, values, elements, symbols, characters,terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the following discussion,it is appreciated that throughout the description, discussions utilizingterms such as “providing,” “generating,” “installing,” “monitoring,”“enforcing,” “receiving,” “logging,” “intercepting,” or the like, referto the actions and processes of a computer system, or similar electroniccomputing device, that manipulates and transforms data represented asphysical (e.g., electronic) quantities within the computer system'sregisters and memories into other data similarly represented as physicalquantities within the computer system memories or registers or othersuch information storage, transmission or display devices.

It is to be understood that the above description is intended to beillustrative, and not restrictive. Many other embodiments will beapparent to those of skill in the art upon reading and understanding theabove description. Although the present invention has been describedwith reference to specific exemplary embodiments, it will be recognizedthat the invention is not limited to the embodiments described, but canbe practiced with modification and alteration within the spirit andscope of the appended claims. Accordingly, the specification anddrawings are to be regarded in an illustrative sense rather than arestrictive sense. The scope of the invention should, therefore, bedetermined with reference to the appended claims, along with the fullscope of equivalents to which such claims are entitled.

We claim:
 1. A method comprising: identifying, by a data loss prevention(DLP) manager, a startup event of a guest virtual machine, wherein theDLP manager is in a security virtual machine; installing, by the DLPmanager, a DLP component in the guest virtual machine, the DLP componentto communicate with the DLP manager; receiving, by the DLP manager, afile system event that is intercepted by the DLP component and that isinitiated within the guest virtual machine, wherein the file systemevent comprises a file in at least one of a write event, a copy event, apaste event, a move event, or a deletion event, and wherein the file isnot stored in the security virtual machine; retrieving, by the DLPmanager, a DLP profile associated with the guest virtual machine from aprofile repository, the DLP profile comprising a DLP policy and aresponse rule; identifying, by the DLP manager, a device associated withthe file system event; determining, by the DLP manager, that the DLPprofile requires monitoring of the identified device; monitoring, by theDLP manager, data associated with the file system event that is to bestored on the identified device; and enforcing, by the DLP manager, theresponse rule associated with the file system event initiated within theguest virtual machine when the file system event violates the DLPpolicy.
 2. The method of claim 1, further comprising installing a DLPuser interface in the guest virtual machine to notify a user of DLPviolations.
 3. The method of claim 1, further comprising: identifying afile close event; identifying a storage target associated with the fileclose event; determining when the DLP policy requires monitoring of thestorage target; analyzing data associated with the file close event todetermine whether the data violates the DLP policy; and executing theresponse rule associated with the DLP policy when the data violates theDLP policy.
 4. The method of claim 3, further comprising logging a DLPpolicy violation when the data violates the DLP policy.
 5. The method ofclaim 1, further comprising: identifying a file open event; identifyinga source device associated with the file open event; determining whenthe DLP policy requires monitoring of the source device; storing a copyof the file; and restoring the copy of the file in the open event whenthe data violates the DLP policy.
 6. The method of claim 5, furthercomprising logging a DLP policy violation when the data violates the DLPpolicy.
 7. A non-transitory computer readable storage medium includinginstructions that, when executed by a processing device, cause theprocessing device to perform a operations comprising: identifying, by adata loss prevention (DLP) manager, a startup event of a guest virtualmachine, wherein the DLP manager is in a security virtual machine;installing, by the DLP manager, a DLP component in the guest virtualmachine, the DLP component to communicate with the DLP manager;receiving, by the DLP manger, a file system event that is intercepted bythe DLP component and that is initiated within the guest virtualmachine, wherein the file system event comprises a file in at least oneof a write event, a copy event, a paste event, a move event, or adeletion event, and wherein the file is not stored in the securityvirtual machine; retrieving, by the DLP manager, a DLP profileassociated with the guest virtual machine from a profile repository, theDLP profile comprising a DLP policy and a response rule; identifying, bythe DLP manager, a device associated with the file system event;determining, by the DLP manager, that the DLP profile requiresmonitoring of the identified device; monitoring, by the DLP manager,data associated with the file system event that is to be stored on theidentified device; and enforcing, by the DLP manager, the response ruleassociated with the file system event initiated within the guest virtualmachine when the file system event violates the DLP policy.
 8. Thecomputer readable storage medium of claim 7, wherein the operationsfurther comprise installing a DLP user interface in the guest virtualmachine to notify a user of DLP violations.
 9. The computer readablestorage medium of claim 7, wherein the operations further comprise:identifying a file close event; identifying a storage target associatedwith the file close event; determining when the DLP policy requiresmonitoring of the storage target; analyzing data associated with thefile close event to determine whether the data violates the DLP policy;and executing the response rule associated with the DLP policy when thedata violates the DLP policy.
 10. The computer readable storage mediumof claim 9, wherein the operations further comprise logging the DLPpolicy violation.
 11. The computer readable storage medium of claim 7,wherein the operations further comprise: identifying a file open event;identifying a source device associated with the file open event;determining when the DLP policy requires monitoring of the sourcedevice; storing a copy of the file; and restoring the copy in the openevent when the data violates the DLP policy.
 12. The computer readablestorage medium of claim 11, wherein the operations further compriselogging a DLP policy violation when the data violates the DLP policy.13. An apparatus comprising: a memory to store instructions for a dataloss prevention (DLP) manager, wherein the DLP manager is in a securityvirtual machine; and a computing device, coupled to the memory, whereinthe computing device is to execute the DLP manager: identify a startupevent of a guest virtual machine; install a DLP component in the guestvirtual machine, the DLP component to communicate with the DLP manager;receive, by the DLP manager, a file system event that is intercepted bythe DLP component and that is initiated within the guest virtualmachine, wherein the file system event comprises a file in at least oneof a write event, a copy event, a paste event, a move event, or adeletion event, and wherein the file is not stored in the securityvirtual machine; retrieve a DLP profile associated with the guestvirtual machine from a profile repository, the DLP profile comprising aDLP policy and a response rule; identify a device associated with thefile system event; determining that the DLP profile requires monitoringof the identified device; monitoring data associated with the filesystem event that is to be stored on the identified device; and enforcethe response rule associated with the file system event initiated withinthe guest virtual machine when the file system event violates the DLPpolicy.
 14. The apparatus of claim 13, wherein the DLP manager isfurther to install a DLP user interface in the guest virtual machine tonotify a user of DLP violations.
 15. The apparatus of claim 13, whereinthe DLP manager is further to: identify a file close event; identify astorage target associated with the file close event; determine when theDLP policy requires monitoring of the storage target; analyze dataassociated with the file close event to determine whether the dataviolates the DLP policy; and execute the response rule associated withthe DLP policy when the data violates the DLP policy.
 16. The apparatusof claim 13, wherein the DLP manager is further to log a DLP policyviolation when the data violates the DLP policy.
 17. The apparatus ofclaim 13, wherein the DLP manager is further to: identify a file openevent; identify a source device associated with the file open event;determine when the DLP policy requires monitoring of the source device;store a copy of the file; and restore the copy of the file in the openevent when the data violates the DLP policy.